Five questions to map your current IAM stack before you buy

1. Where does the list of people come from?

Usually the HR system, feeding a directory. Write down the system of record, how often it syncs and who can edit it. Okta documents HR sources such as Workday, BambooHR and SuccessFactors; Microsoft documents HR-driven provisioning from Workday and SAP SuccessFactors. If the honest answer is "IT creates accounts from emails", the lifecycle job is empty.

2. Which applications are connected, and how?

List every application in audit scope with four columns: single sign-on (SAML or OIDC), SCIM provisioning, a governance connector, or none. Microsoft's own documentation for applications without provisioning describes exporting users to CSV and matching them by hand. If many rows say "none", the application coverage job is larger than you think.

3. How is a leaver removed from each application?

"Disabled in the directory" is not the same as "account removed in the application". Applications with local accounts keep them after the directory account is disabled. For each application, note who removes the account, how, and how anyone would know it was missed.

4. Where does admin access live?

List admin accounts per system, including local admin users inside applications and shared accounts. Note which are standing and which are granted for a task, where passwords and keys are stored, and who rotates them. Secrets in code or configuration files belong on this list.

5. Who would notice an attack on sign-in?

Check what your identity provider includes: Okta sells Identity Threat Protection, and Microsoft includes ID Protection with Entra ID P2. If you run Active Directory, ask who watches it. Semperis offers a free Purple Knight assessment that checks AD, Entra ID and Okta against 218+ indicators, which gives a baseline.

How do the answers map to the five jobs?

• Question 1: directory and single sign-on, and lifecycle and governance.
• Question 2: directory and single sign-on, and application coverage.
• Question 3: lifecycle and governance, and application coverage.
• Question 4: privileged access.
• Question 5: identity threat detection and response.

Mark each job covered, partly covered or empty. The empty ones are your shortlist.

What next?

Take the answers to the stack builder, which applies the same five jobs to your size, applications, audit pressure and identity provider, and to the stack map to see which vendors document each job.